bug#48265: mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

bug#48265: mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

[Maxime Devos]

[-- Attachment #1: Type: text/plain, Size: 2617 bytes --]

Related to: https://issues.guix.gnu.org/22952

On a mate desktop (mate-desktop-service-type).

FN-F9, FN-F10 (binded to ‘decrease brightness’ and ‘increase brightness’):

> Authentication is needed to run '/gnu/store/mp33h4vqdw0scdkjj0v6c3gima9wz8lm-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper' as the super user.

Contents of /etc/polkit-1/actions/org.mate.power.policy:


  [...]
  <icon_name>battery</icon_name>
  <action id="org.mate.power.backlight-helper">
    <!-- SECURITY:
          - A normal active user on the local machine does not need permission
            to change the backlight brightness.
     -->
    <description>Modify the laptop brightness</description>
    <message>Authentication is required to modify the laptop brightness</message>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-help>
  </action>
  [...]

FWIW, the following works as expected (no error message), using the store path in .policy:
$ pkexec /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper --set-brightness=300
Maybe MATE is trying the equivalent of "pkexec /wrong/store/path/mate-power-backlight-helper --etcetera" instead
of referring to the action by name org.mate.power.backlight-helper.

Note the store path is different. Now try something different

$ which mate-power-backlight-helper
> /run/current-system/profile/sbin/mate-power-backlight-helper
$ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
> /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper

Now we have three different store paths so far!

Not sure what the proper way to resolve this, and what causes the three different store paths,
but one way to resolve this would be referring to /run/current-system/profile/sbin/mate-power-backlight-helper
in org.mate.power.policy (untested!).

It looks like there could very well be be similar issues in (unverified):

* /etc/polkit-1/actions/org.gnome.controlcenter.remote-login-helper.policy
* /etc/polkit-1/actions/org.gnome.gnome-system-monitor.policy
* /etc/polkit-1/actions/org.gnome.settings-daemon.plugins.power.policy
* /etc/polkit-1/actions/org.gnome.settings-daemon.plugins.wacom.policy
* grep for /gnu/store/ in /etc/polkit-1/actions/*.policy

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

bug#48265: mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

[Ludovic Courtès]

Hi!

Maxime Devos <maximedevos@telenet.be> skribis:

> FWIW, the following works as expected (no error message), using the store path in .policy:
> $ pkexec /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper --set-brightness=300
> Maybe MATE is trying the equivalent of "pkexec /wrong/store/path/mate-power-backlight-helper --etcetera" instead
> of referring to the action by name org.mate.power.backlight-helper.
>
> Note the store path is different. Now try something different
>
> $ which mate-power-backlight-helper
>> /run/current-system/profile/sbin/mate-power-backlight-helper
> $ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
>> /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper

These are different versions (1.24.2 vs. 1.24.1).  But that’s just two
store file names; where’s the third one?

Isn’t the problem that you reconfigured and so there’s now a mismatch
between the polkit rule in effect, which expects 1.24.1 (say), and the
version you’re running?

(FWIW brightness change works in GNOME.)

Thanks,
Ludo’.

bug#48265: mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

[Maxime Devos]

[-- Attachment #1: Type: text/plain, Size: 2186 bytes --]

Ludovic Courtès schreef op do 06-05-2021 om 23:02 [+0200]:
> Hi!
> 
> Maxime Devos <maximedevos@telenet.be> skribis:
> 
> > FWIW, the following works as expected (no error message), using the store path in .policy:
> > $ pkexec /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper --set-brightness=300
> > Maybe MATE is trying the equivalent of "pkexec /wrong/store/path/mate-power-backlight-helper --etcetera" instead
> > of referring to the action by name org.mate.power.backlight-helper.
> > 
> > Note the store path is different. Now try something different
> > 
> > $ which mate-power-backlight-helper
> > > /run/current-system/profile/sbin/mate-power-backlight-helper
> > $ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
> > > /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper
> 
> These are different versions (1.24.2 vs. 1.24.1).
I didn't notice that. Also, this makes the problem even weirder.
Were does the version mismatch come from?

I would try to run "guix gc --referrers /gnu/store/PATH-WITH-POWER-BACKLIGHT-HELPER"
as that might shed some light on the matter, but I don't have a lot of free time
currently, so I'm hoping someone else fixes the bug first :p.

> But that’s just two store file names; where’s the third one?

1.: Authentication is needed to run
    /gnu/store/mp33h4vqdw0scdkjj0v6c3gima9wz8lm-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper [...]
2.: (in org.mate.power.policy)
    /gnu/store/zk4kb4437032swahywmgyzn55b5w5wj8-mate-power-manager-1.24.2/sbin/mate-power-backlight-helper
3.: $ ls -l /run/current-system/profile/sbin/mate-power-backlight-helper
    > /gnu/store/ffqhy4xdpzkg06rlq76zrbwn8v3rqgw9-mate-1.24.1/sbin/mate-power-backlight-helper

> Isn’t the problem that you reconfigured and so there’s now a mismatch
> between the polkit rule in effect, which expects 1.24.1 (say), and the
> version you’re running?

I've had this problem for a month, I think? I'll try to confirm / falsify
tomorrow. FWIW, I don't see any mate stuff in my use profile.

Greetings,
Maxime.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]

bug#48265: mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

[Maxime Devos]

>> Isn’t the problem that you reconfigured and so there’s now a mismatch
>> between the polkit rule in effect, which expects 1.24.1 (say), and the
>> version you’re running?
> I've had this problem for a month, I think? I'll try to confirm / falsify
> tomorrow. FWIW, I don't see any mate stuff in my use profile.

I booted my system, and the issue is still present.

Greetings,
Maxime.

bug#48265: mate-power-backlight-helper is referred to by store name instead of polkit action (IIUC)

[Maxime Devos]

[-- Attachment #1: Type: text/plain, Size: 704 bytes --]

It looks like my suspicion that "mate-power-backlight-helper" is referred to by absolute
file name instead of by its polkit action is correct:
Excerpt from src/gpm-brightness.c
(https://git.mate-desktop.org/mate-power-manager/tree/src/gpm-brightness.c)

> static gboolean
> gpm_brightness_helper_set_value (const gchar *argument, gint value)
> {
>         [...]
>         /* get the data */
>         command = g_strdup_printf ("pkexec " SBINDIR "/mate-power-backlight-helper --%s %i", argument, value);
>         ret = g_spawn_command_line_sync (command, NULL, NULL, &exit_status, &error);
>         [...]
> }

Next step: look at the GNOME source code, maybe it does things differently.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 260 bytes --]